Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
rollback.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
rollback.exe
Resource
win10v2004-20230915-en
Target
rollback.exe
Size
124KB
MD5
16982dd532b4bc9b17f14242db311b7a
SHA1
7ec8975ce479921cac5ed51775dd156c1bcc0360
SHA256
31fe35cf37b49c657b3e2ff53a5307ef1dbdc2fbe09b87a40316c7a5d8e410b9
SHA512
c7d59956d5c5c1d33124ada180a82f72132131e13990a4f6299b223251c72fa0bf3b7ed0112362a20e5210b016021b658da253403bb08f56e7ad53c005f7ea76
SSDEEP
3072:TpvKUBZc/G3oKa+oRDNBEetbrmcV2xf/oNRDuUlbv81:TRc/G3oKaL9WcV2ojDuUlI1
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegDeleteKeyW
AdjustTokenPrivileges
OpenProcessToken
RegCreateKeyExW
GlobalFree
GlobalAlloc
DelayLoadFailureHook
LoadLibraryExA
ReadFile
ReleaseMutex
SetFileInformationByHandle
GetFileInformationByHandle
GetDiskFreeSpaceW
GetFileInformationByHandleEx
GetCurrentThreadId
GetCurrentDirectoryW
DeleteFileW
SetFileAttributesW
FindClose
DeviceIoControl
FindNextFileW
CompareStringW
FindFirstFileW
LoadLibraryExW
HeapAlloc
ExpandEnvironmentStringsW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
CreateThread
GetLastError
GetModuleFileNameW
GetFileAttributesW
CopyFileW
HeapFree
GetProcessHeap
CreateProcessW
CloseHandle
CreateDirectoryW
LoadLibraryW
GetModuleHandleW
GetWindowsDirectoryW
CreateFileW
WriteFile
CreateMutexW
SetLastError
GetProcAddress
FreeLibrary
WaitForSingleObject
GetTickCount
GetFullPathNameW
SetCurrentDirectoryW
SetBrushOrgEx
CreateFontIndirectW
SetTextAlign
GetStockObject
DeleteObject
CreateCompatibleDC
SelectObject
GetObjectW
SetStretchBltMode
SetBkMode
StretchBlt
DeleteDC
SetTextColor
GetTextAlign
DrawTextW
LoadImageW
DefWindowProcW
PostQuitMessage
DestroyWindow
KillTimer
UnregisterHotKey
EndPaint
BeginPaint
SetWindowPos
InvalidateRect
SetTimer
GetClientRect
DispatchMessageW
GetMessageW
PostThreadMessageW
UpdateWindow
RegisterHotKey
ShowWindow
LoadCursorFromFileW
LoadStringW
MessageBoxW
FindWindowW
UnregisterClassW
GetSystemMetrics
CreateWindowExW
RegisterClassW
LoadCursorW
PeekMessageW
WaitMessage
SendMessageW
_vscwprintf
__CxxFrameHandler3
_wcsnicmp
free
_CxxThrowException
memset
??1type_info@@UEAA@XZ
_wcsicmp
memcpy
__C_specific_handler
wcsrchr
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcschr
wcsstr
_vsnwprintf
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlAllocateHeap
RtlFreeHeap
NtSetInformationFile
RtlNtStatusToDosError
ord17
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
WdsInitialize
WdsTerminate
WdsCreateBlackboard
WdsDestroyBlackboard
WdsSetupLogMessageW
ConstructPartialMsgVW
CurrentIP
WdsSetBlackboardValue
WdsFreeData
WdsGetBlackboardValue
WdsInitializeDataUInt32
??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z
??1Object@UnBCL@@UEAA@XZ
??0Object@UnBCL@@QEAA@XZ
?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@XZ
?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ
?FromASCII@String@UnBCL@@SAPEAV12@PEBD@Z
?FormatV@String@UnBCL@@SAPEAV12@PEBGPEAD@Z
?Concat@String@UnBCL@@SAPEAV12@PEBG00@Z
??3Object@UnBCL@@SAXPEAX@Z
??2Object@UnBCL@@SAPEAX_K@Z
?CreateDir@Directory@UnBCL@@SAPEAVDirectoryInfo@2@PEBVString@2@@Z
?set_HResult@Exception@UnBCL@@MEAAXJ@Z
?get_HResult@Exception@UnBCL@@UEBAJXZ
?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ
?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z
?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ
?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z
?GetObjectID@Object@UnBCL@@UEBAIXZ
?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ
?GetHashCode@Object@UnBCL@@UEBAHXZ
?Equals@Object@UnBCL@@UEBAHPEBV12@@Z
??1ArgumentNullException@UnBCL@@UEAA@XZ
?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ
?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z
?ToString@String@UnBCL@@UEBAPEAV12@XZ
?GetHashCode@String@UnBCL@@UEBAHXZ
?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z
??0ArgumentException@UnBCL@@QEAA@PEBG@Z
??1ArgumentException@UnBCL@@UEAA@XZ
?get_IsEmpty@String@UnBCL@@QEBAHXZ
?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAPEAVString@2@XZ
?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ
?DecRef@Object@UnBCL@@QEAAHXZ
?AddRef@Object@UnBCL@@QEAAXXZ
?Format@String@UnBCL@@SAPEAV12@PEBGZZ
?Compare@String@UnBCL@@SAHPEBG0H@Z
??0Win32Exception@UnBCL@@QEAA@KPEBG@Z
??1Win32Exception@UnBCL@@UEAA@XZ
??0?$Array@E@UnBCL@@QEAA@HH@Z
??_D?$Array@E@UnBCL@@QEAAXXZ
?GetBuffer@?$Array@E@UnBCL@@UEAAPEAEH@Z
?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z
??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z
?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z
?Clone@Object@UnBCL@@UEBAPEAV12@XZ
?Exists@Directory@UnBCL@@SAHPEBVString@2@@Z
??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ
?get_CString@String@UnBCL@@QEBAPEBGXZ
?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ
??1String@UnBCL@@UEAA@XZ
??0String@UnBCL@@QEAA@PEBG@Z
??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ